216.73.217.22

TA0008: TA0008

View on MITRE ATT&CK AlienVault · Published 20/12/2025 22:39 · Modified 29/05/2026 12:20

Essential information

MITRE technique ID
TA0008
Confidence
100/100
Revoked
No
Published
20/12/2025 22:39
Modified
29/05/2026 12:20
Author / Source
AlienVault

Description

No description.

Marking (TLP)

TLP:CLEAR

External references

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.

Intrusion sets (APT) (6)

  • Lazarus uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 21:17 · Modified 29/05/2026 12:20
  • interlock uses
    Ransomware.Live Confidence 100

    No description available

    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 08:54 · Modified 13/03/2026 10:45
  • UTA0178 uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 21/12/2025 03:13 · Modified 21/12/2025 03:13
  • gunra uses
    AlienVault Confidence 100

    No description available

    First seen 01/01/1970 · Last seen 16/11/5138 Published 21/12/2025 15:08 · Modified 29/12/2025 11:12
  • DPRK uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 23:19 · Modified 20/12/2025 23:19
  • APT33 uses HOLMIUMElfin
    The MITRE Corporation Confidence 100

    [APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 16/12/2025 19:39 · Modified 27/03/2026 01:14

Malware (29)

  • SharpHound uses
    Family
    Published 16/01/2026 13:31 · Modified 16/01/2026 13:31
  • Cobalt Strike - S0154 uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 19:39 · Modified 27/05/2026 21:40
  • DoNoT Loader uses
    Family
    Published 24/09/2025 10:28 · Modified 24/09/2025 10:28
  • mimikatz uses
    Family
    Published 11/05/2026 16:15 · Modified 11/05/2026 16:15
  • SafetyKatz uses
    Family
    Published 02/11/2024 01:03 · Modified 02/11/2024 01:03
  • Gunra Ransomware uses
    Family
    Published 24/09/2025 10:28 · Modified 24/09/2025 10:28
  • Roaming Mantis
  • H0lyGh0st
  • Maui
  • Erbium
  • Lumma Stealer uses
    Family
    Published 08/06/2026 19:36 · Modified 08/06/2026 19:36
  • GLASSTOKEN
  • Operation DreamJob
  • CHAINLINE
  • DeathNote
  • Interlock uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Rclone uses
    Family
    Published 11/05/2026 16:15 · Modified 11/05/2026 16:15
  • Gopuram
  • Cl0p uses
    Family
    Published 12/02/2025 16:15 · Modified 12/02/2025 16:15
  • DPRK
  • WIREFIRE
  • BLINDINGCAN
  • Petya
  • LIGHTWIRE
  • Rubeus uses
    Family
    Published 30/04/2026 10:11 · Modified 30/04/2026 10:11
  • BUSHWALK
  • COPPERHEDGE uses
    Family
    Published 24/04/2025 08:13 · Modified 24/04/2025 08:13
  • NukeSped uses
    Family
    Published 10/04/2025 18:50 · Modified 10/04/2025 18:50
  • Ryuk

Reports (5)

Vulnerabilities (CVE) (8)

CVE-2024-21888
8.8 High

A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user …

Attack vector
NETWORK
Published
31/01/2024
Modified
21/12/2025
CVE-2024-22024
8.3 High

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) …

Attack vector
Network
Published
13/02/2024
Modified
27/05/2026
CVE-2021-20038 KEV

SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.

Published
28/01/2022
Modified
20/12/2025
CVE-2024-21893 KEV
8.2 High

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) …

Attack vector
Network
Published
31/01/2024
Modified
27/05/2026
CVE-2021-44228 KEV
10.0 Critical

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Attack vector
Network
Published
10/12/2021
Modified
27/05/2026
CVE-2024-21887 KEV
9.1 Critical

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web …

Attack vector
Network
Published
10/01/2024
Modified
27/05/2026
CVE-2023-46805 KEV
8.2 High

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the …

Attack vector
Network
Published
10/01/2024
Modified
27/05/2026
CVE-2022-24990 KEV
7.5 High

TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.

Attack vector
Network
Published
10/02/2023
Modified
20/12/2025